ISAE 3402 vs SOC 2: what is the difference?

The main difference between ISAE 3402 and SOC 2 is the purpose of the assurance report. ISAE 3402 addresses controls relevant to your clients’ financial reporting. SOC 2 addresses security and other Trust Services categories within the agreed scope.

Compare the reports below to understand their focus, report types and intended users. The appropriate report depends on your services and the assurance your clients require.

What is ISAE 3402?

ISAE 3402 is an international assurance standard designed for service organizations whose services may affect the financial reporting of their clients. An ISAE 3402 report helps demonstrate that relevant internal controls are properly designed and, depending on the report type, operating effectively over time.

This type of report is often relevant for organizations such as:

• payroll providers
• financial service providers
• administrative outsourcing partners
• trust offices and investment-related service organizations

ISAE 3402 report types

• ISAE 3402 Type I
  This report assesses the design and implementation of controls at a specific point in time.
• ISAE 3402 Type II
  This report assesses both the design and the operating effectiveness of controls over a defined review period.

For organizations that support clients’ financial processes, an ISAE 3402 report is often a key way to demonstrate controlled and reliable service delivery.

What is SOC 2?

SOC 2 is an assurance reporting framework developed by the American Institute of Certified Public Accountants, or AICPA. A SOC 2 report is used to assess how an organization manages information security and related controls.

SOC 2 is particularly relevant for organizations such as:

• cloud service providers
• Software as a Service companies
• data centers and hosting providers
• organizations that process sensitive customer data

Trust Services Criteria

SOC 2 reports use the AICPA Trust Services Criteria to assess controls within the agreed scope. There are five categories:

• Security: protecting information and systems against unauthorized access and disclosure.
• Availability: ensuring information and systems are available for operation and use as required.
• Processing integrity: ensuring system processing is complete, valid, accurate, timely and authorized.
• Confidentiality: protecting information designated as confidential.
• Privacy: managing how personal information is collected, used, retained, disclosed and disposed of.

The report identifies which categories are included. Not every SOC 2 report covers all five. The common criteria apply across the categories selected for the engagement.

SOC 2 Type I vs Type II

• Type I: assesses the system description and suitability of control design at a specified date.
• Type II: also assesses the operating effectiveness of controls over a specified period and includes the auditor’s tests and results.

If your client requires evidence that controls operated effectively over time, a Type I report alone will not meet that requirement.

How do SOC 1 and SOC 3 differ from SOC 2?

SOC 1 addresses controls relevant to clients’ financial reporting. Like ISAE 3402, it serves a financial reporting assurance objective, but uses US attestation standards. SOC 1 reports can be Type I or Type II.

SOC 3 is a general-use report addressing controls against the applicable Trust Services Criteria. It provides less detail than SOC 2 and can be distributed publicly.

What is the difference between ISAE 3402 and SOC 2?

The main difference is the reporting objective. ISAE 3402 addresses controls relevant to clients’ financial reporting. SOC 2 addresses controls against the applicable Trust Services Criteria within the agreed scope.

The reports can cover some of the same controls, such as access management or change management, but assess them in relation to different objectives.

Is ISAE 3402 the same as SOC 2?

No. An ISAE 3402 report does not replace a SOC 2 report, or vice versa. Check which report your client requires, including the scope and whether a Type I or Type II report is expected.

Can you combine ISAE 3402 and SOC 2?

Yes, in some cases an organization may benefit from both an ISAE 3402 report and a SOC 2 report.

This is especially relevant for service providers that manage both financially relevant processes and technology-driven environments. For example, an organization may process financial data in a cloud platform or support both business administration and IT operations for clients.

In those situations, a combined or aligned audit approach may be more efficient than running two completely separate assurance tracks. That said, the scope and control criteria must be carefully defined to ensure that each report still addresses the right assurance objective.